linux\u7cfb\u7edf\u8c03\u4f18\u5305\u62ec\u4e24\u4e2a\u6587\u4ef6\uff0c\u4e00\u4e2a\u662flimits.conf\u6587\u4ef6\uff0c\u4e00\u4e2a\u662fsysctl.conf\u6587\u4ef6\uff0c\u8fd9\u4e24\u4e2a\u6587\u4ef6\u5206\u522b\u5728\/etc\/secriuty\/limits.conf\u548c\/etc\/sysctl.conf\u4e0b\uff0c\u5177\u4f53\u4fee\u6539\u5185\u5bb9\u5982\u4e0b\uff1a <\/p>\n\n\n\n
vi \/etc\/security\/limits.conf\n * soft nproc 11000 #\u9650\u5236\u6700\u591a\u6253\u5f00\u7684\u8f6f\u4ef6\u6570\n * hard nproc 11000 #\u9650\u5236\u6253\u5f00\u8f6f\u4ef6\u7684\u6700\u591a\u8fdb\u7a0b\u6570\n * soft nofile 655350#\u9650\u5236\u6700\u591a\u6253\u5f00\u7684\u6587\u4ef6\u6570\n * hard nofile 655350#\u9650\u5236\u6700\u591a\u8fd0\u884c\u7684\u8fdb\u7a0b\u6570\uff0c\u4e00\u822c\u8bbe\u7f6e\u4e3a65535\n\n\n #\u4f18\u5316TCP\n vi \/etc\/sysctl.conf\n #\u7981\u7528\u5305\u8fc7\u6ee4\u529f\u80fd\n net.ipv4.ip_forward = 0 \n #\u542f\u7528\u6e90\u8def\u7531\u6838\u67e5\u529f\u80fd\n net.ipv4.conf.default.rp_filter = 1 \n #\u7981\u7528\u6240\u6709IP\u6e90\u8def\u7531\n net.ipv4.conf.default.accept_source_route = 0 \n #\u4f7f\u7528sysrq\u7ec4\u5408\u952e\u662f\u4e86\u89e3\u7cfb\u7edf\u76ee\u524d\u8fd0\u884c\u60c5\u51b5\uff0c\u4e3a\u5b89\u5168\u8d77\u89c1\u8bbe\u4e3a0\u5173\u95ed\n kernel.sysrq = 0 \n #\u63a7\u5236core\u6587\u4ef6\u7684\u6587\u4ef6\u540d\u662f\u5426\u6dfb\u52a0pid\u4f5c\u4e3a\u6269\u5c55\n kernel.core_uses_pid = 1 \n #\u5f00\u542fSYN Cookies\uff0c\u5f53\u51fa\u73b0SYN\u7b49\u5f85\u961f\u5217\u6ea2\u51fa\u65f6\uff0c\u542f\u7528cookies\u6765\u5904\u7406\n net.ipv4.tcp_syncookies = 1 \n #\u6bcf\u4e2a\u6d88\u606f\u961f\u5217\u7684\u5927\u5c0f\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09\u9650\u5236 \u91cd\u8981\n kernel.msgmnb = 65536 \n #\u6574\u4e2a\u7cfb\u7edf\u6700\u5927\u6d88\u606f\u961f\u5217\u6570\u91cf\u9650\u5236 \u91cd\u8981\n kernel.msgmax = 65536 \n #\u5355\u4e2a\u5171\u4eab\u5185\u5b58\u6bb5\u7684\u5927\u5c0f\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09\u9650\u5236\uff0c\u8ba1\u7b97\u516c\u5f0f64G*1024*1024*1024(\u5b57\u8282)\n kernel.shmmax = 68719476736 \n #\u6240\u6709\u5185\u5b58\u5927\u5c0f\uff08\u5355\u4f4d\uff1a\u9875\uff0c1\u9875 = 4Kb\uff09\uff0c\u8ba1\u7b97\u516c\u5f0f16G*1024*1024*1024\/4KB(\u9875)\n kernel.shmall = 4294967296 \n #timewait\u7684\u6570\u91cf\uff0c\u9ed8\u8ba4\u662f180000\n net.ipv4.tcp_max_tw_buckets = 6000 \n #\u5f00\u542f\u6709\u9009\u62e9\u7684\u5e94\u7b54\n net.ipv4.tcp_sack = 1 \n #\u652f\u6301\u66f4\u5927\u7684TCP\u7a97\u53e3. \u5982\u679cTCP\u7a97\u53e3\u6700\u5927\u8d85\u8fc765535(64K), \u5fc5\u987b\u8bbe\u7f6e\u8be5\u6570\u503c\u4e3a1\n net.ipv4.tcp_window_scaling = 1 \n #TCP\u8bfbbuffer\n net.ipv4.tcp_rmem = 4096 131072 1048576\n #TCP\u5199buffer\n net.ipv4.tcp_wmem = 4096 131072 1048576 \n #\u4e3aTCP socket\u9884\u7559\u7528\u4e8e\u53d1\u9001\u7f13\u51b2\u7684\u5185\u5b58\u9ed8\u8ba4\u503c\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09\n net.core.wmem_default = 8388608\n #\u4e3aTCP socket\u9884\u7559\u7528\u4e8e\u53d1\u9001\u7f13\u51b2\u7684\u5185\u5b58\u6700\u5927\u503c\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09\n net.core.wmem_max = 16777216 \n #\u4e3aTCP socket\u9884\u7559\u7528\u4e8e\u63a5\u6536\u7f13\u51b2\u7684\u5185\u5b58\u9ed8\u8ba4\u503c\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09 \n net.core.rmem_default = 8388608\n #\u4e3aTCP socket\u9884\u7559\u7528\u4e8e\u63a5\u6536\u7f13\u51b2\u7684\u5185\u5b58\u6700\u5927\u503c\uff08\u5355\u4f4d\uff1a\u5b57\u8282\uff09\n net.core.rmem_max = 16777216\n #\u6bcf\u4e2a\u7f51\u7edc\u63a5\u53e3\u63a5\u6536\u6570\u636e\u5305\u7684\u901f\u7387\u6bd4\u5185\u6838\u5904\u7406\u8fd9\u4e9b\u5305\u7684\u901f\u7387\u5feb\u65f6\uff0c\u5141\u8bb8\u9001\u5230\u961f\u5217\u7684\u6570\u636e\u5305\u7684\u6700\u5927\u6570\u76ee \u91cd\u8981\n net.core.netdev_max_backlog = 262144 \n #web\u5e94\u7528\u4e2dlisten\u51fd\u6570\u7684backlog\u9ed8\u8ba4\u4f1a\u7ed9\u6211\u4eec\u5185\u6838\u53c2\u6570\u7684net.core.somaxconn\u9650\u5236\u5230128\uff0c\u800cnginx\u5b9a\u4e49\u7684 \n NGX_LISTEN_BACKLOG\u9ed8\u8ba4\u4e3a511\uff0c\u6240\u4ee5\u6709\u5fc5\u8981\u8c03\u6574\u8fd9\u4e2a\u503c\n net.core.somaxconn = 262144 \n #\u7cfb\u7edf\u4e2d\u6700\u591a\u6709\u591a\u5c11\u4e2aTCP\u5957\u63a5\u5b57\u4e0d\u88ab\u5173\u8054\u5230\u4efb\u4f55\u4e00\u4e2a\u7528\u6237\u6587\u4ef6\u53e5\u67c4\u4e0a\u3002\u8fd9\u4e2a\u9650\u5236\u4ec5\u4ec5\u662f\u4e3a\u4e86\u9632\u6b62\u7b80\u5355\u7684DoS\u653b \n \u51fb\uff0c\u4e0d\u80fd\u8fc7\u5206\u4f9d\u9760\u5b83\u6216\u8005\u4eba\u4e3a\u5730\u51cf\u5c0f\u8fd9\u4e2a\u503c\uff0c\u66f4\u5e94\u8be5\u589e\u52a0\u8fd9\u4e2a\u503c(\u5982\u679c\u589e\u52a0\u4e86\u5185\u5b58\u4e4b\u540e)\n net.ipv4.tcp_max_orphans = 3276800 \n #\u8bb0\u5f55\u7684\u90a3\u4e9b\u5c1a\u672a\u6536\u5230\u5ba2\u6237\u7aef\u786e\u8ba4\u4fe1\u606f\u7684\u8fde\u63a5\u8bf7\u6c42\u7684\u6700\u5927\u503c\u3002\u5bf9\u4e8e\u6709128M\u5185\u5b58\u7684\u7cfb\u7edf\u800c\u8a00\uff0c\u7f3a\u7701\u503c\u662f1024\uff0c\u5c0f\u5185\u5b58 \n \u7684\u7cfb\u7edf\u5219\u662f128\n net.ipv4.tcp_max_syn_backlog = 262144 \n #\u65f6\u95f4\u6233\u53ef\u4ee5\u907f\u514d\u5e8f\u5217\u53f7\u7684\u5377\u7ed5\u3002\u4e00\u4e2a1Gbps\u7684\u94fe\u8def\u80af\u5b9a\u4f1a\u9047\u5230\u4ee5\u524d\u7528\u8fc7\u7684\u5e8f\u5217\u53f7\u3002\u65f6\u95f4\u6233\u80fd\u591f\u8ba9\u5185\u6838\u63a5\u53d7\u8fd9\u79cd\u201c\u5f02 \n \u5e38\u201d\u7684\u6570\u636e\u5305\u3002\u8fd9\u91cc\u9700\u8981\u5c06\u5176\u5173\u6389\n net.ipv4.tcp_timestamps = 0 \n #\u4e3a\u4e86\u6253\u5f00\u5bf9\u7aef\u7684\u8fde\u63a5\uff0c\u5185\u6838\u9700\u8981\u53d1\u9001\u4e00\u4e2aSYN\u5e76\u9644\u5e26\u4e00\u4e2a\u56de\u5e94\u524d\u9762\u4e00\u4e2aSYN\u7684ACK\u3002\u4e5f\u5c31\u662f\u6240\u8c13\u4e09\u6b21\u63e1\u624b\u4e2d\u7684\u7b2c \n \u4e8c\u6b21\u63e1\u624b\u3002\u8fd9\u4e2a\u8bbe\u7f6e\u51b3\u5b9a\u4e86\u5185\u6838\u653e\u5f03\u8fde\u63a5\u4e4b\u524d\u53d1\u9001SYN+ACK\u5305\u7684\u6570\u91cf\n net.ipv4.tcp_synack_retries = 1 \n #\u5728\u5185\u6838\u653e\u5f03\u5efa\u7acb\u8fde\u63a5\u4e4b\u524d\u53d1\u9001SYN\u5305\u7684\u6570\u91cf\n net.ipv4.tcp_syn_retries = 1 \n #\u5f00\u542fTCP\u8fde\u63a5\u4e2dtime_wait sockets\u7684\u5feb\u901f\u56de\u6536\n net.ipv4.tcp_tw_recycle = 1 \n #\u5f00\u542fTCP\u8fde\u63a5\u590d\u7528\u529f\u80fd\uff0c\u5141\u8bb8\u5c06time_wait sockets\u91cd\u65b0\u7528\u4e8e\u65b0\u7684TCP\u8fde\u63a5\uff08\u4e3b\u8981\u9488\u5bf9time_wait\u8fde\u63a5\uff09\u91cd\u8981\n net.ipv4.tcp_tw_reuse = 1 \n\n net.ipv4.tcp_fin_timeout = 15 \n #\u8868\u793a\u5f53keepalive\u8d77\u7528\u7684\u65f6\u5019\uff0cTCP\u53d1\u9001keepalive\u6d88\u606f\u7684\u9891\u5ea6\uff08\u5355\u4f4d\uff1a\u79d2\uff09 \u91cd\u8981\n net.ipv4.tcp_keepalive_time = 30 \n #\u5bf9\u5916\u8fde\u63a5\u7aef\u53e3\u8303\u56f4\n net.ipv4.ip_local_port_range = 2048 65000\n #\u8868\u793a\u6587\u4ef6\u53e5\u67c4\u7684\u6700\u5927\u6570\u91cf\n fs.file-max = 102400<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"linux\u7cfb\u7edf\u8c03\u4f18\u5305\u62ec\u4e24\u4e2a\u6587\u4ef6\uff0c\u4e00\u4e2a\u662flimits.conf\u6587\u4ef6\uff0c\u4e00\u4e2a\u662fsysctl.conf\u6587\u4ef6\uff0c\u8fd9\u4e24\u4e2a\u6587\u4ef6 […]<\/p>\n","protected":false},"author":3,"featured_media":4041,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,22],"tags":[],"class_list":["post-4039","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","category-server"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/4039","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/comments?post=4039"}],"version-history":[{"count":1,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/4039\/revisions"}],"predecessor-version":[{"id":4040,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/4039\/revisions\/4040"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media\/4041"}],"wp:attachment":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media?parent=4039"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/categories?post=4039"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/tags?post=4039"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}